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CLAIMS 

1. Traceable method for encrypting and/or decrypting data broadcast by at least 
one transmitter towards several decoders, this method enabling the identification of a traitor, 
5 amongst different lawful users of the decoders, who has communicated secret data to a non- 
authorized third party so that this third party is able to encrypt and/or decrypt data broadcast 
by the transmitter, 
in which: 

- during encryption of the broadcast data, the transmitter applies at least a first secret 
10 cryptographic function, and 

- during decryption of said broadcast data, all the decoders apply at least one same 
second secret cryptographic function identical to said first function or its inverse, each 
decoder having recourse for this purpose to a mathematical description of said second 
function recorded in a memory, 

15 characterized in that during the application of the second function the mathematical 

description of this second function, to which each decoder has recourse, is different from one 
decoder to another or from one group of decoders to another so that the mathematical 
description to which recourse is made exclusively identifies the particular decoder or group 
of decoders among all the decoders. 

20 2. Method as in claim 1, characterized in that the second cryptographic function 

is able to process non-redimdant data. 

3. Method as in claim 1 or 2, characterized in that said mathematical description 
(FKj) recorded in the memory of each decoder is formed of several elementary functions (Gi j) 
which must be composed with each other in a determined order to form said second secret 

25 function. 

4. Method as in claim 3, characterized in that each elementary function (Gij) is 
equal to the composite of at least three functions as per one of the following equations: 

Gij=f^jOgaj(i)OS 

G2J=f 2J Ogaj(2) Ofij 
30 

Gr-lJ = f V-1 j Ogoj (r-1) Ofr.2j 

GrJ = TOgoj (r)OfMj 



in which: 
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- Gij is the -th elementary function of decoder j, j being the index identifying a 
decoder or group of decoders, 

- functions fij and f 'ij are predefined functions able to render the elementary 
functions Gi j non-commutative between each other, 

5 -Oj is a permutation of all indices {1; r} unique to each decoder or group of 

decoders, 

- goj(t) is the aj(t) -th function of a predefined whole formed of r non-linear predefined 
functions gi commutative between each other, and 

- S and T are predefined functions able to render difficult the cryptanalysis of 
10 elementary functions Gi j and Grj respectively, 

5. Method as in claim 4 or 5, characterized in that each function f is equal to 

the inverse f ^ of function fj j. 

6. Method as in claim 4 or 5, characterized in that the functions fij are linear 
functions of a set (L"") of the tuples of elements of a finished body (L) on itself. 

15 7. Method as in any of claims 4 to 6, characterized in that the functions S and T 

are invertible. 

8. Method as in any of claims 4 to 7, characterized in that the functions S and T 
are linear functions of a set (L*") of the tuples of elements of a finished body (L) towards 
itself 

20 9. Method as in any of claims 4 to 8, characterized in that the functions gi are 

chosen so that each elementary function Gij corresponds to an encryption block of a 
multivariate encryption algorithm. 

10. Method as in any of claims 4 to 9, characterized in that each function gi is of 
the form gi(a) = a^^ in which a is an element of an L' extension of degree n of a basic body L 

25 with q elements, and Ci is a predefined exponent, 

1 1 . Method as in claim 10, characterized in that the exponent Cj is of the form : 

d\ 81 6d 1 

1+^ + . . + . . > in which the exponents 0i are predefined integers. 
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12. Data recording medium, characterized in that it comprises instructions for the 
execution of a traceable encryption and/or decryption method according to any of the 
preceding claims, when these instructions are executed by a decoder. 

13. Data recording medium, characterized in that it comprises instructions for the 
5 execution of a traceable data encryption and/or decryption method as in any of claims 1 to 

10, when said instructions are executed by a transmitter. 

14. Traceable system for encrypting and/or decrypting broadcast data capable of 
identifying a traitor, among different lawful users, who has communicated secret data to a 
non-authorized third party so that this third party is able to encrypt and/or decrypt the 

10 broadcast data, this system comprising: 

- a transmitter able to encrypt broadcast data, this transmitter being capable of 
applying at least a first secret cryptographic function, to directly process a message, then of 
broadcasting the message, 

- several decoders able to decrypt broadcast data, all the decoders being able to apply 
15 a second secret cryptographic function identical to said first function or to its inverse for the 

direct processing of said broadcast message, each decoder for this purpose being equipped 
with a memory in which a mathematical description of said second function is recorded; 

characterized in that the memory of each decoder contains a mathematical description 
of said second function different from the one recorded in the memory of the other decoders 
20 or in the memory of the other groups of decoders so that this mathematical description 
exclusively identifies the particular decoder or group of decoders among all the decoders. 

15. Memory intended to be associated with a decoder of a traceable data 
encryption and/or decryption system according to claim 13, characterized in that it comprises 
a mathematical description equivalent to said second secret function able to be used by the 

25 decoder, this mathematical description consisting of several elementary functions (Gjj) each 
of which is equal to the composite of at least three functions as per one of the following 
equations: 

GlJ=f*ljOgorj(l)OS 

G2J=f 2j Ogaj(2) Ofij 

30 

Gr-1 j = f V-IJ Ogoj (r-l) Ofr-2j 
GrJ = TOgflrj(r)Ofr.lj 



in which: 
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- Gij is the -th elementary function of decoder j, j being the index identifying a 
decoder or group of decoders, 

- functions fij and f 'jj are predefined functions able to render the elementary 
functions Gij non-commutative between each other, 

-Oj is a permutation of all indices {1; r} unique to each decoder or group of 
decoders, 

- goj(t) is the Oj(t) -th function of a predefined whole formed of r non-linear predefined 
functions gi commutative between each other, and 

- S and T are predefined functions able to render difficult the cryptanalysis of 
elementary functions Gij and Grj respectively. 



